The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists. An unauthenticated, local attacker can exploit this to bypass     authentication and execute unauthorized arbitrary commands. (CVE-2021-28451, CVE-2021-28453, CVE-2021-28454)

  - A information disclosure vulnerability exists. An unauthenticated, local attacker can exploit this to disclose     potentially sensitive information. (CVE-2021-28456)

Detections

Analytics

Security Updates for Microsoft Office Online Server and Microsoft Office Web Apps (April 2021)

high Nessus Plugin ID 148538

Version 1.5